Vulnerabilities

TI-2026-51587 CVE-2026-73475 · GHSA-828j-363w-82c9

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

MEDIUM 47

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00404 Published 2026-09-02 Fixed in 1.12.0, 2.1.3 CWE-863

TI-2026-56066 CVE-2026-81159 · GHSA-7q92-q5vc-5r4r

LOW 17

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00256 Published 2026-09-02 Fixed in 1.10.0 CWE-208

TI-2026-09252 CVE-2026-10769 · GHSA-rq79-xhrq-f62x

LOW 24

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00231 Published 2026-07-10 Fixed in 3.3.6 CWE-79